Securing homelab, reverse proxy, wireguard vpn server or cloudflare tunnel? reddit / selfhosted ---------------------------------------------------------------------- gh057k33p3r · 2023-09-28 22:09 Hi, I started my homelab journey 3 weeks ago, learned a lot, but I'm still not sure what is the best option to expose some services through the internet. I only want to be able to access home assistant, which sends notifications to my phone when frigate detects some objects so I can check the videos, and also jellyfin, so I can watch my stuff whenever I'm not at home. I exposed them using NGINX Proxy Manager, latest docker images, lets encrypt certificates, force https. Only port 80 TCP/UDP and 443 TCP/UDP was opened in the router, and forwarded to my proxy manager. Everything seems to be working, I also installed goaccess to check the logs and I can already see some crawlers found me. I'm looking at geoip restrictions, but not sure how can I do it with NPM. Today I tried WireGuard VPN Server, only 51820 UDP is opened, everything seems to be working (except bind9 local dns for vpn clients, but thats an other story) I know there is an option to close all ports and just use a cloudflare tunnel, but I don't want to break the ToS by using jellyfin. I know if a port is opened and a service is listening on it will always have a risk, but the question is are these considered to be "safe enough"? Which one is better? For now all ports are closed. ---------------------------------------------------------------------- devkareem · 2023-09-28 23:11 Cloudflare tunnel of course, you get the best of both worlds no open ports and publicly accessible services which you can then protect access to them using many cloudflare authentication methods or simply connecting to WARP from anywhere and keep WireGuard as backup or Tailscale. ---------------------------------------------------------------------- ericesev · 2023-09-29 00:44 My bias is toward self hosted solutions. WireGuard sounds good to me if you're not comfortable exposing NPM directly. I get web crawlers in my logs constantly. I mostly ignore them. [https://imgur.com/a/sKpjHPs](https://imgur.com/a/sKpjHPs) That said, all the ports I have exposed require authentication. That prevents most things. For the higher skilled attacks I use AppArmor and have alerts for policy violations, crashed processes, too many logins, etc.